Vulnerabilities

TI-2023-26581 CVE-2023-48751 · GHSA-v7j7-wq78-r9fc

WordPress Participants Database Plugin <= 2.5.5 is vulnerable to Broken Access Control

LOW 38

Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.Th…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0025 Published 2023-12-18 No fix listed CWE-352

TI-2023-14941 CVE-2023-31235 · GHSA-9fvm-c82m-5q5f

WordPress Participants Database Plugin <= 2.4.9 is vulnerable to Cross Site Request Forgery (CSRF)

MEDIUM 40

Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.9 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00336 Published 2023-11-09 No fix listed CWE-352

TI-2022-23650 CVE-2022-47612 · GHSA-j8m5-chrv-m4wv

WordPress Participants Database Plugin <= 2.4.5 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 20

Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00231 Published 2023-02-28 No fix listed CWE-352

TI-2020-06892 CVE-2020-8596 · GHSA-xw39-q6xj-4gq5

participants-database.php in the Participants Database plugin 1.9.5.5 and previous…

LOW 36

participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.01624 Published 2020-02-10 No fix listed CWE-89

TI-2017-10289 CVE-2017-14126 · GHSA-jcvp-j4vx-x62g

The Participants Database plugin before 1.7.5.10 for WordPress has XSS.

LOW 32

The Participants Database plugin before 1.7.5.10 for WordPress has XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02302 Published 2017-09-04 No fix listed CWE-79

TI-2014-03230 CVE-2014-3961 · GHSA-g887-5vqh-7jc5

SQL injection vulnerability in the Export CSV page in the Participants Database plugin…

MEDIUM 41

SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" act…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.05643 Published 2014-06-04 No fix listed CWE-89

Vulnerabilities

Filters

WordPress Participants Database Plugin <= 2.5.5 is vulnerable to Broken Access Control

WordPress Participants Database Plugin <= 2.4.9 is vulnerable to Cross Site Request Forgery (CSRF)

WordPress Participants Database Plugin <= 2.4.5 is vulnerable to Cross Site Request Forgery (CSRF)

participants-database.php in the Participants Database plugin 1.9.5.5 and previous…

The Participants Database plugin before 1.7.5.10 for WordPress has XSS.

SQL injection vulnerability in the Export CSV page in the Participants Database plugin…